CVE-2018-11776

What is Apache Struts?

Apache Struts is an open-source MVC framework for building Java web applications, widely embedded in enterprise portals, e-commerce platforms, and government systems. It became infamous a year earlier via CVE-2017-5638, the OGNL injection bug behind the 2017 Equifax breach. CVE-2018-11776 is a distinct, later vulnerability in the same family of OGNL (Object-Graph Navigation Language) expression-evaluation flaws, and it affects the framework's core namespace-handling logic rather than the Content-Type header parsing used in the Equifax bug.

Overview

CVE-2018-11776 is a remote code execution vulnerability triggered purely through URL manipulation, with no file upload or special headers required. It arises when an application uses Struts' <s:url> or <s:a> tags without setting both a value/action attribute, combined with an upper-level package configuration that has no namespace or a wildcard namespace, or when alwaysSelectFullNamespace is enabled (true by default in Struts apps built on Struts 2 Convention Plugin). Under these conditions, Struts evaluates part of the request URL as an OGNL expression, giving an attacker a direct path to arbitrary code execution. Because the trigger involves common, easily-overlooked configuration patterns, a large share of real-world Struts deployments were vulnerable.

Technical Details

The root cause is untrusted input reaching an OGNL evaluation context (CWE-94, Code Injection) via the namespace portion of the URL rather than a form parameter. An attacker crafts a URL path segment containing an OGNL payload; when Struts falls through the vulnerable namespace-resolution logic, it evaluates that segment as an expression instead of a literal path, executing attacker-controlled Java code with the privileges of the web application. This is unauthenticated and remote (no credentials, no user interaction), but the attack complexity is rated High because it depends on the specific "vulnerable configuration" combination being present — not every Struts app using the framework is exploitable, only those matching the namespace/tag pattern described above.

Discovery

The vulnerability was discovered and responsibly disclosed by security researcher Man Yue Mo of the Semmle Security Research Team (later acquired by GitHub), the same team that had previously found other Struts OGNL flaws. Apache credited the finding in security bulletin S2-057.

Exploitation Context

Public proof-of-concept exploits appeared within days of disclosure, and mass internet scanning for vulnerable Struts installations began almost immediately given the framework's popularity and the memory of the Equifax breach the year before. CISA's KEV entry confirms sustained real-world exploitation of this specific CVE, distinct from — but often confused with — the 2017 Equifax-associated Struts vulnerability.

Remediation

1. Upgrade to Apache Struts 2.3.35 or 2.5.17 (or later), which contain the fix described in bulletin S2-057.
2. Audit application code for <s:url> and <s:a> tags that omit both value and action attributes, especially in packages with no or wildcard namespace configuration.
3. Explicitly set alwaysSelectFullNamespace to false where safe, and review any place it is relied upon.
4. Run static/dynamic scanning against internet-facing Struts applications to confirm the vulnerable pattern is not present post-upgrade.
5. Review web server and application logs for anomalous URL paths containing OGNL syntax (e.g., %24%7B, #context, @java.lang.Runtime) indicating exploitation attempts.